CVE-2026-64609
A flaw in Apache Fory allows an attacker to read memory beyond a buffer when using the optional zero‑copy deserialization feature. The vulnerability can expose confidential data and crash the application. It is fixed in version 1.4.0.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Fory (formerly Apache Fury) versions 0.5.0 up to, but not including, 1.4.0. Versions before 0.11.0 were published under org.apache.fury:fury-core. Applications that enable the optional zero‑copy deserialization feature are at risk.
Real-world impact
An attacker who can trigger the vulnerable deserialization path could read arbitrary data from the process memory, potentially leaking secrets or causing a denial of service.
Why this severity
The CVSS score of 9.1 reflects that the flaw is exploitable over the network with no authentication, no user interaction, and can lead to complete data disclosure and application crash.
What to do about it
- 01Upgrade Apache Fory to version 1.4.0 or later.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 27, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- lists.apache.org/thread/rdv22ks3b0cxh0r52w3g…vendor advisory
- openwall.com/lists/oss-security/2026/07/…third party advisory